ThreatExpert Report: Packed.Generic.237, Trojan-Downloader.NUS, Generic Packed, Troj/Agent-HAP..

Submission Summary:

Submission details:

Submission received: 9 July 2009, 09:53:08
Processing time: 8 min 5 sec
Submitted sample:

File MD5: 0x39EF491B937577930F7057F2A7D2E3F4
File SHA-1: 0x53211FC6E298FBB3F48D21C1401EC03298950889
Filesize: 10,752 bytes
Alias: Packed.Generic.237 [Symantec]

Summary of the findings:

What's been found	Severity Level
Downloads/requests other files from Internet.

Technical Details:

File System Modifications

The following file was created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	10,752 bytes	MD5: 0x39EF491B937577930F7057F2A7D2E3F4 SHA-1: 0x53211FC6E298FBB3F48D21C1401EC03298950889	Packed.Generic.237 [Symantec]

Other details

To mark the presence in the system, the following Mutex objects were created:

DDrawWindowListMutex
DDrawDriverObjectListMutex
__DDrawExclMode__

The data identified by the following URLs was then requested from the remote web server:

http://cfnctufbkz.com/progs/fcvwjo/mftghu
http://cfnctufbkz.com/progs/fcvwjo/mssgxk.php
http://dfeuvyoage.net/progs/fcvwjo/mssgxk.php
http://cfnctufbkz.com/progs/fcvwjo/vffgmffg.php
http://dfeuvyoage.net/progs/fcvwjo/vffgmffg.php
http://cfnctufbkz.com/progs/fcvwjo/rnbbctgfpd.php
http://dfeuvyoage.net/progs/fcvwjo/rnbbctgfpd.php
http://cfnctufbkz.com/progs/fcvwjo/pwsggkycpq.php
http://cfnctufbkz.com/progs/fcvwjo/exkll.php
http://dfeuvyoage.net/progs/fcvwjo/exkll.php
http://cfnctufbkz.com/progs/fcvwjo/wwgxyy.php
http://dfeuvyoage.net/progs/fcvwjo/wwgxyy.php
http://cfnctufbkz.com/progs/fcvwjo/cesfggkhvm.php?adv=adv656
http://dfeuvyoage.net/progs/fcvwjo/cesfggkhvm.php?adv=adv656
http://dfeuvyoage.net/progs/fcvwjo/mftghu
http://dfeuvyoage.net/progs/fcvwjo/pwsggkycpq.php

Downloaded File Summary:

Download details:

Download retrieved: 9 July 2009 10:01:14
Processing time: 12 min 10 sec
Downloaded sample #1:

File MD5: 0x994BA082273E7A21F17A712E70226C2F
File SHA-1: 0xBE90DEAF1E9160D7F8AAECBB3048D7A9A37BDF46
Filesize: 9,216 bytes
Alias: Packed.Generic.237 [Symantec]

Downloaded sample #2:

File MD5: 0x102FF59F4530E084005A2E04B768E9C1
File SHA-1: 0xCE177C806F37945EA7786116479D5B4D3FF2F07C
Filesize: 705 bytes
Alias & packer info:

Trojan-Downloader.NUS [PCTools]
Generic Packed [McAfee]
Troj/Agent-HAP [Sophos]
Virus.Win32.Virut.n [Ikarus]
Win-Trojan/Tinytro.705 [AhnLab]
packed with: FSG [Kaspersky Lab]

Downloaded sample #3:

File MD5: 0xAB5A027E3A0447233DA56B1ED88F59F3
File SHA-1: 0xC4B9E86C83BA9B8145071B43D0D4D02F45D62FA1
Filesize: 25,088 bytes
Alias:

Trojan Horse [Symantec]
Trojan.Win32.FraudPack.pfw [Kaspersky Lab]
FakeAlert-ES [McAfee]
Mal/Generic-A [Sophos]
Trojan-Downloader.Win32.Dontovo [Ikarus]
Win-Trojan/Fraudpack.25088.F [AhnLab]

Downloaded sample #4:

File MD5: 0x8A2926ADDCAD7A28A30CF31BDCDE8943
File SHA-1: 0x0D8FB0F31B2E33CBFBB69D7302A64470ECA40A19
Filesize: 93,184 bytes
Alias:

Downloader [Symantec]
New Win32.g5 [McAfee]

Downloaded sample #5:

File MD5: 0x9939F16D04B3328CDDE271380BAD6344
File SHA-1: 0x8579DA5EFC66348179BD9EA9985478887E2A5946
Filesize: 24,576 bytes
Alias:

Downloaded sample #6:

File MD5: 0x7EEA0E292730041EC0CF68B9359D2AB2
File SHA-1: 0xD024081C181CAE70C8DABEEA8195752E81B498BD
Filesize: 39,424 bytes
Alias & packer info:

Trojan.Adclicker [Symantec]
Generic.dx!tv [McAfee]
Mal/Generic-A [Sophos]
Trojan-Dropper.Agent [Ikarus]
packed with: PE-Pack [Kaspersky Lab]

Summary of the findings:

What's been found	Severity Level
Contains characteristics of an identified security risk.

Technical Details:

Possible Security Risk

Attention! Characteristics of the following security risk was identified in the system:

Security Risk	Description
Trojan-Downloader.NUS	Trojan-Downloader.NUS tries to contact a remote server in order to download additional malware onto a users computer without their knowledge.

Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A program that downloads files to the local computer that may represent security risk

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	[file and pathname of the sample #1]	9,216 bytes	MD5: 0x994BA082273E7A21F17A712E70226C2F SHA-1: 0xBE90DEAF1E9160D7F8AAECBB3048D7A9A37BDF46	Packed.Generic.237 [Symantec]
2	[file and pathname of the sample #2]	705 bytes	MD5: 0x102FF59F4530E084005A2E04B768E9C1 SHA-1: 0xCE177C806F37945EA7786116479D5B4D3FF2F07C	Trojan-Downloader.NUS [PCTools] Generic Packed [McAfee] Troj/Agent-HAP [Sophos] Virus.Win32.Virut.n [Ikarus] Win-Trojan/Tinytro.705 [AhnLab] packed with FSG [Kaspersky Lab]
3	[file and pathname of the sample #3]	25,088 bytes	MD5: 0xAB5A027E3A0447233DA56B1ED88F59F3 SHA-1: 0xC4B9E86C83BA9B8145071B43D0D4D02F45D62FA1	Trojan Horse [Symantec] Trojan.Win32.FraudPack.pfw [Kaspersky Lab] FakeAlert-ES [McAfee] Mal/Generic-A [Sophos] Trojan-Downloader.Win32.Dontovo [Ikarus] Win-Trojan/Fraudpack.25088.F [AhnLab]
4	[file and pathname of the sample #4]	93,184 bytes	MD5: 0x8A2926ADDCAD7A28A30CF31BDCDE8943 SHA-1: 0x0D8FB0F31B2E33CBFBB69D7302A64470ECA40A19	Downloader [Symantec] New Win32.g5 [McAfee]
5	[file and pathname of the sample #5]	24,576 bytes	MD5: 0x9939F16D04B3328CDDE271380BAD6344 SHA-1: 0x8579DA5EFC66348179BD9EA9985478887E2A5946	Packed.Generic.233 [Symantec] Generic.dx!sz [McAfee] Mal/EncPk-IV [Sophos] Trojan.Win32.Ertfor [Ikarus] Win-Trojan/Zpack.24576.J [AhnLab]
6	[file and pathname of the sample #6]	39,424 bytes	MD5: 0x7EEA0E292730041EC0CF68B9359D2AB2 SHA-1: 0xD024081C181CAE70C8DABEEA8195752E81B498BD	Trojan.Adclicker [Symantec] Generic.dx!tv [McAfee] Mal/Generic-A [Sophos] Trojan-Dropper.Agent [Ikarus] packed with PE-Pack [Kaspersky Lab]

Other details

Analysis of the file resources indicate the following possible country of origin:

Russian Federation

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.